Dumb question: does this affect a backend even if behind an ouath wall?

pja an hour ago | parent | next [-]

If the oauth wall is managed by PHP, then it looks like the answer is yes, you’re vulnerable to client connections that haven’t logged in.

This looks like a bug in PHP’s assembly of multipart responses & you can feed one of those to the PHP backend with a simple web request, no auth required I think.

▲

jeroenhd 5 hours ago | parent | prev | next [-]

If the backend can be reached, yes.

If you put the oauth wall in front of the application before it can even reach PHP (i.e. in your nginx/caddy/apache config), then no, assuming all paths are covered.

▲

redox99 6 hours ago | parent | prev | next [-]

Probably yes

▲

afdbcreid 5 hours ago | parent | prev [-]

If anyone can login, probably yes. If only trusted people can, probably no.

	▲	pixl97 5 hours ago \| parent [-]
		Just remember that your LLM doesn't count as trusted people.